Skip to content
OpenAdvisories
High ALAS2-2026-3794 1 CVE

Important: ruby security update (Amazon Linux 2)

Published Jul 6, 2026 · Updated Jul 7, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-42246: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

Fixed packages 16

ReleasePackageFixed in
Amazon Linux · 2 ruby 0:2.0.0.648-36.amzn2.0.20
Amazon Linux · 2 ruby-debuginfo 0:2.0.0.648-36.amzn2.0.20
Amazon Linux · 2 ruby-devel 0:2.0.0.648-36.amzn2.0.20
Amazon Linux · 2 ruby-doc 0:2.0.0.648-36.amzn2.0.20
Amazon Linux · 2 ruby-irb 0:2.0.0.648-36.amzn2.0.20
Amazon Linux · 2 ruby-libs 0:2.0.0.648-36.amzn2.0.20
Amazon Linux · 2 ruby-tcltk 0:2.0.0.648-36.amzn2.0.20
Amazon Linux · 2 rubygem-bigdecimal 0:1.2.0-36.amzn2.0.20
Amazon Linux · 2 rubygem-io-console 0:0.4.2-36.amzn2.0.20
Amazon Linux · 2 rubygem-json 0:1.7.7-36.amzn2.0.20
Amazon Linux · 2 rubygem-minitest 0:4.3.2-36.amzn2.0.20
Amazon Linux · 2 rubygem-psych 0:2.0.0-36.amzn2.0.20
Amazon Linux · 2 rubygem-rake 0:0.9.6-36.amzn2.0.20
Amazon Linux · 2 rubygem-rdoc 0:4.0.0-36.amzn2.0.20
Amazon Linux · 2 rubygems 0:2.0.14.1-36.amzn2.0.20
Amazon Linux · 2 rubygems-devel 0:2.0.14.1-36.amzn2.0.20

Vulnerabilities 1

  • High 7.6
    CVE-2026-42246

    net-imap vulnerable to STARTTLS stripping via invalid response timing

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issu…

    ruby net-imap kube-fluentd-operator logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-42246.html